How to get service name(process name) by port number in kernel?

pologuy · 04-16-2012, 08:58 AM

Hi all,

I need to know how to get service name(process name) by port number in kernel. Does anyone can help me?

I know function of "getserbyport" can get service by port number in userspace, but don't know the similar way in kernel.

Thanks a lot.

jklaverstijn · 04-17-2012, 02:22 AM

I use lsof. For example: lsof -i :<portnumber>. This gives the pid of the process accessing the port. From this you can use ps to get th eprocess name.

There is bound to be a way by going through /proc but I do not know by heart.

Good luck, Jan.

ta0kira · 04-17-2012, 07:00 AM

Quote:

Originally Posted by pologuy

I know function of "getserbyport" can get service by port number in userspace, but don't know the similar way in kernel.

This function parses /etc/services. The more "current" userspace method is getnameinfo. I don't know where it gets info from, but I assume it's from the same place. I don't think there's any built-in way to get that information in kernel space.
Kevin Barry

waltinator · 04-17-2012, 08:05 PM

If a process has a port open, the kernel knows about it. Reading the lsof source might give you a hint. However, knowing that PID ### has TCP Port ## open, plus all the information you can get from /proc/### will NOT let you know what service the process is providing. One can write a simple program, call it "telnetd", run it on port 8080 (or port 80, if you're root).